Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 4, 2024, 10:05 a.m.	Sept. 4, 2024, 10:18 a.m.

Size	13.4MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`26dc83cd26d56041c731e497b96a8a73`
SHA256	`b8927abe41a230bb684bcd01fa78d688ccf6c0df1c2177a46510b76df9f6ea6a`
CRC32	`0D9C2713`
ssdeep	`98304:VMn0GMXcSmy3VNtIspTgHVf3U8WPK1MyvUfhsyUPMuOdQI:Vu0GBSmyesaHVEU8mLMu`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

66d5edf357fbf_BitcoinCore.exe "C:\Users\test22\AppData\Local\Temp\66d5edf357fbf_BitcoinCore.exe"
2428

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didata

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000012b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 region_size: 2203648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 region_size: 2203648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004170000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 region_size: 2134016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004390000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 region_size: 2576384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000045a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2576384 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff		-1073741800
NtAllocateVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 region_size: 2576384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 1998848 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140001000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000014020a000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 4, 2024, 9:59 a.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 4, 2024, 9:59 a.m.	process_identifier: 2428 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000014020a000 process_handle: 0xffffffffffffffff	1	0

Foreign language identified in PE resource (2 events)

name

RT_ICON

language

LANG_CATALAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_LIBYA

offset

0x00aa0840

size

0x00010828

name

RT_GROUP_ICON

language

LANG_CATALAN

filetype

data

sublanguage

SUBLANG_ARABIC_LIBYA

offset

0x00d82d74

size

0x00000014

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x002e4200', u'virtual_address': u'0x00a9f000', u'entropy': 7.3843495406179, u'name': u'.rsrc', u'virtual_size': u'0x002e4200'}

entropy

7.38434954062

description

A section with a high entropy has been found

entropy

0.21640290925

description

Overall entropy of this PE file is high

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.SleepObf.4!c
MicroWorld-eScan	Trojan.GenericKD.74005901
BitDefender	Trojan.GenericKD.74005901
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Avast	Win64:MalwareX-gen [Trj]
Kaspersky	Trojan.Win64.SleepObf.jk
Rising	Trojan.Kryptik@AI.100 (RDML:FsYOWZDqT+LTdLR9FlO4sg)
Emsisoft	Trojan.GenericKD.74005901 (B)
McAfeeD	ti!B8927ABE41A2
FireEye	Trojan.GenericKD.74005901
Sophos	Mal/Generic-S
Google	Detected
MAX	malware (ai score=84)
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Ransom.Win64.Wacatac.cl
Arcabit	Trojan.Generic.D4693D8D
ZoneAlarm	Trojan.Win64.SleepObf.jk
Microsoft	Trojan:Win32/Wacatac.B!ml
DeepInstinct	MALICIOUS
Ikarus	Trojan.Win32.Delf
AVG	Win64:MalwareX-gen [Trj]

66d5edf357fbf_BitcoinCore.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All